Method and system for dynamic evaluation of a wireless network with a portable computing device

• US 6,801,756 B1
• Filed: 02/08/2002
• Issued: 10/05/2004
• Est. Priority Date: 02/08/2002
• Status: Expired due to Fees

• Current Assignee: McAfee, Inc. (McAfee, LLC)
• Original Assignee: Networks Associates Technology, Inc. (McAfee, LLC)
• Inventors: Agrawal, Ajay, Malpani, Raghavendra, Saraswati, Abhishek, Hate, Ashish, Rao, Suryaprashant, Prakash, Apurva, Sathya, Sriharsha, Neelakantamurthy, Yashovan, Schmitz, Peter O.
• Primary Examiner(s): Milord, Marceau
• Application Number:
  US10/071,907
• Time in Patent Office: 970 Days
• Field of Search: 455/67.11, 455/445, 455/556.2, 455/556.1, 455/557, 455/566, 370/908, 370/909, 370/242, 370/252, 370/280, 370/349, 370/437
• US Class Current: 455/67.11
• CPC Class Codes: H04L 41/0681 Configuration of triggering conditions
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 Generation of reports
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/0829 Packet loss
• CPC Class Codes: H04L 43/0847 Transmission error
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 43/18 Protocol analysers
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: Y10S 370/908 Local area network

Abstract

Aspects of the invention are found in an apparatus for monitoring data on a wireless network. The data is transmitted according to a wireless data network protocol across the network. The apparatus is contained on a portable wireless network analysis device. The portable wireless network analysis device has a wireless network interface that communicatively couples the portable wireless network analysis device to the wireless network. This allows the portable wireless network analysis device to receive data from the wireless network. The portable wireless network analysis device also has a network traffic analyzer. The network traffic analyzer is communicatively coupled to the wireless network interface. The analyzer receives and analyzes the data received from the wireless network. The portable wireless network analysis device is capable of being operated by user at one location and transported to second location. The portable wireless network analysis device is able to continue to monitor data on the wireless network while being transported from the first location to the second location. The apparatus may also have a user interface. Information about the data may be displayed on the user interface. In a specific instance, the user interface is a display screen. The apparatus can have a storage system. The storage system stores the data when initiated by a user. The apparatus can also have a filter system. The filter system filters the data based on a predefined criteria. The apparatus may have an alarm system. The alarm system indicates when a predefined network event has occurred.

Claims

1. An apparatus for monitoring data on a wireless network operating according to a wireless data network protocol, the apparatus comprising:

a portable wireless network analysis device, the portable wireless network analysis device comprising;

a wireless network interface that communicatively couples the portable wireless network analysis device to the wireless network and receives data flowing on the wireless network;

a network traffic analyzer, communicatively coupled to the wireless network interface, that receives the data and performs an analysis of the data received from the wireless network; and

the portable wireless network analysis device capable of being operated by user at one location and transported to second location, the portable wireless network analysis device operable to continue to monitor data on the wireless network while being transported from the first location to the second location;

wherein the portable wireless network analysis device is further capable of;

changing a channel on which the data is received,

detecting rogue access points on the wireless network,

displaying a relative load on each of a plurality of access points within a range based on a throughput,

supporting channel surfing activity,

reporting statistics related to frames including control frames, data frames, and management frames, during the channel surfing activity, and

analyzing changes selected from the group consisting of a channel change associated with a network device and a physical location change associated with the network device.

2. The apparatus of claim 1 further comprising:

a user interface that displays information about the data.

3. The apparatus of claim 2, the user interface comprising a screen.

4. The apparatus of claim 1 wherein the portable wireless network analysis device is a personal digital assistant.

5. The apparatus of claim 1 further comprising a storage system, the storage system storing the data when initiated by a user.

6. The apparatus of claim 1 further comprising a filter system, the filter system filtering the data based on a predefined criteria.

7. The apparatus of claim 6 wherein the predefined criteria is a network address.

8. The apparatus of claim 6 wherein the predefined criteria is a packet type.

9. The apparatus of claim 1 further comprising an alarm system, the alarm system indicating when a predefined network event has occurred.

10. The apparatus of claim 9 wherein the predefined network event is based on a rate of specific network events.

11. The apparatus of claim 9 wherein the predefined network event is based on a use of the network.

12. The apparatus of claim 11 wherein the predefined network event is based on a rate of data exchange.

13. The apparatus of claim 11 wherein the predefined network event is based on a utilization rate.

14. The apparatus of claim 9 wherein the predefined network event is the occurrence of a specific network event.

15. The apparatus of claim 14 wherein the specific network event indicates an error in data transmission.

16. The apparatus of claim 14 wherein the specific network event is based on a network address.

17. The apparatus of claim 14 wherein the specific network event is a predetermined number of network events.

18. An apparatus for monitoring data on a wireless network, the data transmitted according to a wireless network protocol, the data arranged in a transport protocol, the apparatus comprising:

a portable wireless network analysis device, the portable wireless network analysis device comprising;

a wireless network interface that communicatively couples the portable wireless network analysis device to the wireless network and receives data from the wireless network;

a network traffic analyzer, communicatively coupled to the wireless network interface, that receives the data and performs an analysis of the data relative to the wireless network protocol; and

the portable wireless network analysis device capable of being dynamically relocated from a first location to a second location, the portable wireless network analysis device operable to monitor the wireless network traffic while during the relocation from the first location to the second location;

wherein the portable wireless network analysis device is further capable of;

changing a channel on which the data is received,

detecting rogue access points on the wireless network,

displaying a relative load on each of a plurality of access points within a range based on a throughput,

supporting channel surfing activity,

reporting statistics related to frames including control frames, data frames, and management frames, during the channel surfing activity, and

analyzing changes selected from the group consisting of a channel change associated with a network device and a physical location change associated with the network device.

19. The apparatus of claim 18 further comprising:

a user interface that displays information about the data.

20. The apparatus of claim 19, the user interface comprising a screen.

21. The apparatus of claim 18 wherein the portable wireless network analysis device is a personal digital assistant.

22. The apparatus of claim 18 further comprising a storage system, the storage system storing the data when initiated by a user.

23. The apparatus of claim 18 further comprising a filter system, the filter system filtering the data based on a predefined criteria.

24. The apparatus of claim 23 wherein the predefined criteria is a network address.

25. The apparatus of claim 23 wherein the predefined criteria is a packet type.

26. The apparatus of claim 18 further comprising an alarm system, the alarm system indicating when a predefined network event has occurred.

27. The apparatus of claim 26 wherein the predefined network event is based on a use of the network.

28. The apparatus of claim 27 wherein the predefined network event is based on a rate of data exchange.

29. The apparatus of claim 27 wherein the predefined network event is based on a utilization rate.

30. The apparatus of claim 26 wherein the predefined network event is the occurrence of a specific network event.

31. The apparatus of claim 30 wherein the specific network event indicates an error in data transmission.

32. The apparatus of claim 30 wherein the specific network event is based on a network address.

33. The apparatus of claim 30 wherein the specific network event is a predetermined number of network events.

34. The apparatus of claim 26 wherein the predefined network event is based on a rate of specific network events.

35. A method for monitoring data on a wireless network, the data transmitted according to a wireless network protocol, the method comprising:

receiving data from the wireless network with a wireless network interface, the wireless network interface contained in a portable wireless network analysis device;

analyzing the wireless network data; and

selectively, relocating the portable wireless network analysis device from a first location to a second location, the portable wireless network analysis device still performing the steps of receiving and analyzing concurrently with the step of relocating;

wherein the portable wireless network analysis device is further capable of;

changing a channel on which the data is received,

detecting rogue access points on the wireless network,

displaying a relative load on each of a plurality of access points within a range based on a throughput,

supporting channel surfing activity,

reporting statistics related to frames including control frames, data frames, and management frames, during the channel surfing activity, and

analyzing changes selected from the group consisting of a channel change associated with a network device and a physical location change associated with the network device.

36. The method of claim 35 further comprising:

displaying information about the data from a user interface contained within the portable wireless network analysis device.

37. The method of claim 36, the user interface comprising a screen.

38. The method of claim 35 wherein the portable wireless network analysis device is a personal digital assistant.

39. The method of claim 35 further comprising:

storing the data in a storage system when initiated by a user.

40. The method of claim 35 further comprising:

filtering the data based on a predefined criteria.

41. The method of claim 40 wherein the predefined criteria is a network address.

42. The method of claim 40 wherein the predefined criteria is a packet type.

43. The method of claim 35 further comprising:

indicating when a predefined network event has occurred.

44. The method of claim 43 wherein the predefined network event is based on a use of the network.

45. The method of claim 44 wherein the predefined network event is based on a rate of data exchange.

46. The method of claim 44 wherein the predefined network event is based on a utilization rate.

47. The method of claim 43 wherein the predefined network event is the occurrence of a specific network event.

48. The method of claim 47 wherein the specific network event indicates an error in data transmission.

49. The method of claim 47 wherein the specific network event is based on a network address.

50. The method of claim 47 wherein the specific network event is a predetermined number of network events.

51. The method of claim 43 wherein the predefined network event is based on a rate of specific network events.

52. An apparatus for monitoring data on a wireless network, the data transmitted according to a wireless network protocol, the apparatus comprising a computer readable medium having instructions, the apparatus responsive to the instructions, the apparatus comprising:

instructions for receiving data from the wireless network with a wireless network interface, the wireless network interface contained in a portable wireless network analysis device;

instructions for analyzing the wireless network data; and

the portable wireless network analysis device being selectively relocatable from a first location to a second location, the apparatus operable to perform the steps of receiving and analyzing concurrently with the step of relocating;

wherein the portable wireless network analysis device is further capable of;

changing a channel on which the data is received,

detecting rogue access points on the wireless network,

displaying a relative load on each of a plurality of access points within a range based on a throughout,

supporting channel surfing activity,

reporting statistics related to frames including control frames, data frames, and management frames, during the channel surfing activity, and

analyzing changes selected from the group consisting of a channel change associated with a network device and a physical location change associated with the network device.

53. The apparatus of claim 52 further comprising:

instructions for displaying information about the data from a user interface contained within the portable wireless network analysis device.

54. The apparatus of claim 53, the user interface comprising a screen.

55. The apparatus of claim 52 wherein the portable wireless network analysis device is a personal digital assistant.

56. The apparatus of claim 52 further comprising:

instructions for storing the data in a storage system when initiated by a user.

57. The apparatus of claim 52 further comprising:

instructions for filtering the data based on a predefined criteria.

58. The apparatus of claim 57 wherein the predefined criteria is a network address.

59. The apparatus of claim 57 wherein the predefined criteria is a packet type.

60. The apparatus of claim 52 further comprising:

instructions for indicating when a predefined network event has occurred.

61. The apparatus of claim 60 wherein the predefined network event is based on a rate of specific network events.

62. The apparatus of claim 60 wherein the predefined network event is based on a use of the network.

63. The apparatus of claim 62 wherein the predefined network event is based on a rate of data exchange.

64. The apparatus of claim 62 wherein the predefined network event is based on a utilization rate.

65. The apparatus of claim 60 wherein the predefined network event is the occurrence of a specific network event.

66. The apparatus of claim 65 wherein the specific network event indicates an error in data transmission.

67. The apparatus of claim 65 wherein the specific network event is based on a network address.

68. The apparatus of claim 65 wherein the specific network event is a predetermined number of network events.

69. A wireless computing network for exchanging data between network devices using a wireless data connection, the wireless computing network comprising:

a first wireless network device;

a second wireless network device communicatively coupled to the first wireless network device through the wireless data connection;

the first wireless network device and second wireless network device exchanging the data through the wireless data connection;

a handheld computing device, communicatively coupled to the first wireless network device, the handheld computing device comprising;

a wireless network interface that monitors the data on the wireless data connection; and

an analysis module, communicatively coupled to the wireless network interface, that analyzes the data;

wherein the handheld computing device is further capable of;

changing a channel on which the data is received,

detecting rogue access points on the wireless network,

displaying a relative load on each of a plurality of access points within a range based on a throughput,

supporting channel surfing activity,

reporting statistics related to frames including control frames, data frames, and management frames, during the channel surfing activity, and

analyzing changes including a channel change associated with one of the network devices and a physical location change associated with one of the network devices.

70. A handheld computing device for monitoring data on a wireless network, the wireless network communicatively coupling a first network device to a second network device, the handheld computing device comprising:

a wireless network interface that monitors the data on the wireless network; and

a network analysis module, communicatively coupled to the wireless network interface, that analyzes the data;

wherein the network analysis module is further capable of;

changing a channel on which the data is received,

detecting rogue access points on the wireless network,

displaying a relative load on each of a plurality of access points within a range based on a throughput,

supporting channel surfing activity,

reporting statistics related to frames including control frames, data frames, and management frames, during the channel surfing activity, and

analyzing changes selected from the group consisting of a channel change associated with a network device and a physical location change associated with the network device.

71. A method for analyzing a wireless network utilizing a portable wireless network analysis device, comprising:

receiving data from the wireless network with a wireless network interface, the wireless network interface contained in a portable wireless network analysis device;

analyzing the wireless network data utilizing the portable wireless network analysis device;

collecting information selected from the group consisting of source addresses, destination addresses, dropped packets, packet types, and packet sizes, utilizing the portable wireless network analysis device;

collating statistics selected from the group consisting of packet totals, distribution of packet sizes, numbers of broadcasts, numbers of multicasts, numbers of errors of varying types, channel use statistics, utilization statistics, and packet rate statistics, utilizing the portable wireless network analysis device;

decoding the data, utilizing the portable wireless network analysis device;

detecting noise associated with the receipt of the data, utilizing the portable wireless network analysis device; and

detecting a power level associated with the receipt of the data, utilizing the portable wireless network analysis device;

wherein the portable wireless network analysis device is further capable of;

changing a channel on which the data is received,

detecting rogue access points on the wireless network,

displaying a relative load on each of a plurality of access points within a range based on a throughput,

supporting channel surfing activity,

reporting statistics related to frames including control frames, data frames, and management frames, during the channel surfing activity, and

analyzing changes selected from the group consisting of a channel change associated with a network device and a physical location change associated with the network device.

72. The apparatus of claim 71, wherein the portable wireless network analysis device is further capable of collecting information including the source addresses, the destination addresses, the dropped packets, the packet types, and the packet sizes.

73. The apparatus of claim 71, wherein the portable wireless network analysis device is further capable of collating statistics including the packet totals, the distribution of packet sizes, the numbers of broadcasts, the numbers of multicasts, the numbers of errors of varying types, the channel use statistics, the utilization statistics, and the packet rate statistics.

74. The apparatus of claim 71, wherein each packet is an 802.11 network packet.

75. The apparatus of claim 71, wherein each packet is followed by a DLC layer acknowledge packet.

76. The apparatus of claim 71, wherein the portable wireless network analysis device is capable of being dynamically modified to monitor alternate wireless formats.

77. The apparatus of claim 71, wherein the portable wireless network analysis device is capable of being dynamically modified to provide alternative analysis tools.

78. The apparatus of claim 71, wherein the portable wireless network analysis device includes an application program interface (API).